AWS CloudTrail: AWS Identity Center Identity Provider Configuration Changes
Detects CloudTrail identity center events that associate or change the external identity provider configuration.
- Product
- aws
- Service
- cloudtrail
- Author
- Michael McIntyre @wtfender (SigmaHQ), DRL 1.1
- Published
- 2023-09-27
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags CloudTrail events related to AWS Identity Center (formerly AWS SSO) identity provider changes, including directory association/disassociation and external identity provider configuration enable/disable actions. Such changes can allow an attacker to maintain access or potentially impersonate users by altering which identity provider is trusted for authentication. The detection relies on CloudTrail events from the sso-directory.amazonaws.com and sso.amazonaws.com event sources with the specified event names.
Reporting behind it
- docs.aws.amazon.comhttps://docs.aws.amazon.com/singlesignon/latest/userguide/app-enablement.html
- docs.aws.amazon.comhttps://docs.aws.amazon.com/singlesignon/latest/userguide/sso-info-in-cloudtrail.html
- docs.aws.amazon.comhttps://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiamidentitycentersuccessortoawssinglesign-on.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_sso_idp_change.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "AWS CloudTrail: AWS Identity Center Identity Provider Configuration Changes"
id: 9804be12-a38d-42ec-82ab-1c8ccdf81dc3
status: test
description: This rule flags CloudTrail events related to AWS Identity Center (formerly AWS SSO) identity provider changes, including directory association/disassociation and external identity provider configuration enable/disable actions. Such changes can allow an attacker to maintain access or potentially impersonate users by altering which identity provider is trusted for authentication. The detection relies on CloudTrail events from the sso-directory.amazonaws.com and sso.amazonaws.com event sources with the specified event names.
references:
- https://docs.aws.amazon.com/singlesignon/latest/userguide/app-enablement.html
- https://docs.aws.amazon.com/singlesignon/latest/userguide/sso-info-in-cloudtrail.html
- https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiamidentitycentersuccessortoawssinglesign-on.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_sso_idp_change.yml
author: Michael McIntyre @wtfender, Huntrule Team
date: 2023-09-27
tags:
- attack.persistence
- attack.credential-access
- attack.defense-impairment
- attack.t1556
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource:
- sso-directory.amazonaws.com
- sso.amazonaws.com
eventName:
- AssociateDirectory
- DisableExternalIdPConfigurationForDirectory
- DisassociateDirectory
- EnableExternalIdPConfigurationForDirectory
condition: selection
falsepositives:
- Authorized changes to the AWS account's identity provider
level: high
license: DRL-1.1
related:
- id: d3adb3ef-b7e7-4003-9092-1924c797db35
type: derived